diff --git a/nixos/modules/services/security/tor.nix b/nixos/modules/services/security/tor.nix index 10596d6431d..3f1450ebfbd 100644 --- a/nixos/modules/services/security/tor.nix +++ b/nixos/modules/services/security/tor.nix @@ -46,8 +46,20 @@ let ServerTransportPlugin obfs2,obfs3 exec ${pkgs.pythonPackages.obfsproxy}/bin/obfsproxy managed ''} '' + + hiddenServices + cfg.extraConfig; + hiddenServices = concatStrings (mapAttrsToList (hiddenServiceDir: hs: + let + hsports = concatStringsSep "\n" (map mkHiddenServicePort hs.hiddenServicePorts); + in + "HiddenServiceDir ${hiddenServiceDir}\n${hsports}\n${hs.extraConfig}\n" + ) cfg.hiddenServices); + + mkHiddenServicePort = hsport: let + trgt = optionalString (hsport.target != null) (" " + hsport.target); + in "HiddenServicePort ${toString hsport.virtualPort}${trgt}"; + torRcFile = pkgs.writeText "torrc" torRc; in { @@ -229,11 +241,11 @@ in default = null; example = "450 GBytes"; description = '' - Specify maximum bandwidth allowed during an accounting - period. This allows you to limit overall tor bandwidth - over some time period. See the - AccountingMax option by looking at the - tor manual (man tor) for more. + Specify maximum bandwidth allowed during an accounting period. This + allows you to limit overall tor bandwidth over some time period. + See the AccountingMax option by looking at the + tor manual tor + 1 for more. Note this limit applies individually to upload and download; if you specify "500 GBytes" @@ -247,10 +259,11 @@ in default = null; example = "month 1 1:00"; description = '' - Specify length of an accounting period. This allows you to - limit overall tor bandwidth over some time period. See the - AccountingStart option by looking at - the tor manual (man tor) for more. + Specify length of an accounting period. This allows you to limit + overall tor bandwidth over some time period. See the + AccountingStart option by looking at the tor + manual tor + 1 for more. ''; }; @@ -279,9 +292,10 @@ in type = types.str; example = "143"; description = '' - What port to advertise for Tor connections. This corresponds - to the ORPort section in the Tor manual; see - man tor for more details. + What port to advertise for Tor connections. This corresponds to the + ORPort section in the Tor manual; see + tor + 1 for more details. At a minimum, you should just specify the port for the relay to listen on; a common one like 143, 22, 80, or 443 @@ -314,6 +328,72 @@ in ''; }; }; + + hiddenServices = mkOption { + type = types.attrsOf (types.submodule ({ + options = { + hiddenServicePorts = mkOption { + type = types.listOf (types.submodule { + options = { + virtualPort = mkOption { + type = types.int; + example = 80; + description = "Virtual port."; + }; + target = mkOption { + type = types.nullOr types.str; + default = null; + example = "127.0.0.1:8080"; + description = '' + Target virtual Port shall be mapped to. + + You may override the target port, address, or both by + specifying a target of addr, port, addr:port, or + unix:path. (You can specify an IPv6 target as + [addr]:port. Unix paths may be quoted, and may use + standard C escapes.) + ''; + }; + }; + }); + example = [ { virtualPort = 80; target = "127.0.0.1:8080"; } { virtualPort = 6667; } ]; + description = '' + If target is null the virtual port is mapped + to the same port on 127.0.0.1 over TCP. You may use + target to overwrite this behaviour (see + description of target). + + This corresponds to the HiddenServicePort VIRTPORT + [TARGET] option by looking at the tor manual + tor + 1 for more information. + ''; + }; + extraConfig = mkOption { + type = types.str; + default = ""; + description = '' + Extra configuration. Contents will be added in the current + hidden service context. + ''; + }; + }; + })); + default = {}; + example = { + "/var/lib/tor/webserver" = { + hiddenServicePorts = [ { virtualPort = 80; } ]; + }; + }; + description = '' + Configure hidden services. + + Please consult the tor manual + tor + 1 for a more detailed + explanation. (search for 'HIDDEN'). + ''; + }; }; };